MFA passed. The session still got stolen.

MFA still blocks a huge share of password-based attacks. AiTM is a different failure mode: the victim completes a real Microsoft challenge through an attacker-controlled proxy, then the attacker steals the session after MFA. Protect the session — not only the password.

MFA still works — with an important caveat

Microsoft Research (2023) studied multifactor authentication in a commercial Azure AD / Entra population and found MFA reduced the risk of compromise by 99.22% overall — and by 98.56% when credentials had already leaked. Those figures are about password stuffing and credential-leak attacks. They are not a measurement of Evilginx-style AiTM resistance.

So the honest message for Michigan SMBs is both/and: keep MFA on (or turn it on if you have not), then harden the session path with phishing-resistant methods, Conditional Access, and a clear revoke-sessions playbook when something looks wrong.

What AiTM session theft looks like

Adversary-in-the-middle kits sit between your employee and Microsoft’s real sign-in page. The person often sees a familiar Microsoft login, enters credentials, and completes a genuine MFA challenge. The attacker’s proxy relays that traffic in real time, then captures the authenticated session cookie. With that cookie, the attacker can reuse the session — often without triggering another MFA prompt.

Typical flow:

The employee clicks a lure — often a “document share,” DocuSign-themed envelope, or similar urgent link — and lands on a phishing page that proxies the real Microsoft sign-in.

They enter username and password. The attacker’s kit relays those credentials to Microsoft in real time.

They complete MFA for a genuine Microsoft challenge (push, SMS, or one-time code). Ordinary MFA methods can be relayed through AiTM.

The kit captures the authenticated session cookie after MFA succeeds.

The attacker reuses that session. A password reset alone is not enough — you need to revoke sessions and refresh tokens, then review Entra / Microsoft 365 sign-in activity.

What public research has documented

These are public threat-research examples — not KW customer incidents. They show how session theft after MFA is being packaged and sold.

NovaCookies (Island, August 2026)

Island researchers described a phishing-as-a-service offering advertised at about $320 per month (also $200 for fourteen days) that relays Microsoft 365 logins in real time and captures authenticated sessions after password and MFA. Their reporting pointed to hundreds of organizations targeted, infrastructure that expanded from mid-May and continued through August 2026, and 755 domains in a companion IOC set. Observed delivery included genuine DocuSign envelopes carrying counterfeit document-share lures — with DocuSign and Microsoft themselves not compromised; those services were abused as delivery or redirect layers. Dark Reading independently covered the same Island findings.

BigBear 2.0 (CloudSEK / CSO Online, September 2026)

CloudSEK reported an Evilginx2-based operation known as BigBear 2.0. In the panel data they reviewed: 4,148 session cookies, 474 completed MFA-bypassed authentications, and 461 organizations. CSO Online’s coverage aligned on those core counts. Researchers also noted custom code intended to interfere with FIDO2/WebAuthn on phishing pages (steering victims toward weaker MFA) and that residential proxies can weaken location-based Conditional Access checks.

What to do

Practical next steps (checklist)

Bottom line for Mid-Michigan teams

Free Quote

Sources / Further reading
Public research and documentation used for educational commentary. See original articles for full analysis:
Island — NovaCookies · Dark Reading — NovaCookies · CloudSEK — BigBear 2.0 · CSO Online — BigBear 2.0 · Microsoft Research 2023 — MFA efficacy